@rebasepro/server-postgres 0.21.0 → 0.21.1

package/dist/index.es.js

@@ -3,22 +3,22 @@ __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
 import { a as createDirectDatabaseConnection, c as guardPoolAgainstDirtyRelease, l as pinSearchPath, o as createPostgresDatabaseConnection, r as cappedPoolMax, s as createReadReplicaConnection, t as DatabasePoolManager, u as poolMaxCeiling } from "./databasePoolManager-Bj5FbeAs.js";
 import { f as hiddenColumnsOption, l as SEARCH_UNACCENT_FN, m as searchColumnNames, o as sharedRelationName, u as buildSearchColumnSpec, x as visibleColumnProjection } from "./plan-schema-Hgl62S-w.js";
-import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-C3g_kHBw.js";
-import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-W3DMfcZZ.js";
+import { d as extractPgError, f as isRoleSwitchingPermissionError, g as sanitizeErrorForClient, h as reachedDatabase, i as diagnoseDbError, l as classifyConnectFailure, m as pgErrorToFriendlyMessage, n as deepestErrorMessage, o as isEconnrefused, p as isRowLevelSecurityDenial, s as parseHostInfo, u as extractCauseMessage } from "./cli-errors-Dka89exj.js";
+import { r as BranchingUnsupportedError, t as BranchService } from "./BranchService-CucnFcSE.js";
 import { c as warnOnLegacyRlsFunctions, i as ensureAppRole, l as warnOnRoleSchemaCollision, n as applyAuthContext, o as validatePolicyPgRoles, r as detectConnectionPosture, s as warnOnAnonymousGrants, t as REBASE_USER_ROLE } from "./rls-enforcement-C6Xk0lA6.js";
 import { l as resolveColumnName } from "./column-plan-helpers-CpILzHJS.js";
 import { i as isAuthCollection, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
 import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "./generate-postgres-ddl-logic-CR2xcS7e.js";
-import { t as generateSchema } from "./generate-drizzle-schema-logic-Dfyf_MRu.js";
-import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Bkvehxdm.js";
-import { t as main } from "./generate-drizzle-schema-vSK-VdYT.js";
+import { t as generateSchema } from "./generate-drizzle-schema-logic-DFa9qy9u.js";
+import { a as readSchemaFactsFor, r as planCollectionSchemaEnsure } from "./ensure-collection-tables-Cr2ye5JC.js";
+import { t as main } from "./generate-drizzle-schema-D2MDdJt-.js";
 import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as getServerVersionMajor, d as pruneBackups, f as resolvePgBinary, g as selectBackupsToPrune, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BNLwvxuy.js";
 import { i as resolveAuthSchema, r as probeAuthSchema, t as ensureAuthTablesExist } from "./ensure-tables-BnEvEJPr.js";
 import { c as identifyJoinTables, d as singularize, h as humanize, i as buildTablesMap, m as mapPgType, r as buildEnumMap, s as getIconForTable } from "./introspect-db-logic-C6LQdTxj.js";
 import { Client } from "pg";
-import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
+import { ApiError, assertFieldOpsValid, assertWriteRequestValid, createDdlBootstrapper, createEmailService, declaredErrorAnswer, extractUserFromToken, logger, rawQueryLoggingEnabled, resolveBatchRefs, resolveRequireAuth, safeCompare, splitFieldOps } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isNotNull, isNull, isTable, lt, not, notInArray, or, relations, sql } from "drizzle-orm";
-import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
+import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, JUNCTION_PIVOT_KEY, ListLimitError, MAX_INCLUDE_DEPTH, Vector, declaredDatabaseExtensions, encodeRelationAggregateSort, hasForeignKeyOnTarget, isChannelBusInstance, isChannelBusInstance as isChannelBusInstance$1, isManyToMany, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, parseEnvBoolean, parseRelationAggregateSort, resolveClientListLimit } from "@rebasepro/types";
 import { COMPOSITE_ID_SEPARATOR, COMPOSITE_ID_SEPARATOR as COMPOSITE_ID_SEPARATOR$1, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, OrderBySpecError, REBASE_USER_ROLE as REBASE_USER_ROLE$1, applyDefaultValuesOnCreate, buildCompositeId, buildCompositeId as buildCompositeId$1, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, classifyTable, createRelationRef, createRelationRefWithData, detectJunctionTables, encodeCursor, fieldKeyForColumn, findRelation, firstSqlRow, getColumnName, getDeclaredPrimaryKeys, getJunctionCollectionConfig, getJunctionConfigForRelation, getTableName as getTableName$1, getTenantConfig, isAddressableId, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeToEntityRelation, parseIdValues, parseOrderBySpecStrict, requireCallbackClient, requireCallbackCollection, resolveCollectionRelations, resolveJunctionSpecs, resolveTenantWrite, revokeInternalTableSql, sqlRows, tenantBypassRoles, toCallbackError, toFilterTuples, updateDateAutoValues, updateUserAutoValues } from "@rebasepro/common";
 import { camelCase, firstFreeKey, generateForeignKeyName, isPrototypePollutingKey, legacyForeignKeyName, mergeDeep, toSnakeCase, toWireKey, unref } from "@rebasepro/utils";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -6021,13 +6021,12 @@ async function generateSchemaCommit(input) {
 * them. It is the only sanctioned way a statement that named a role runs
 * without it — every other route now refuses.
 *
-* Exact `"true"` on purpose, matching the check this replaced. `=1` and `=yes`
-* silently do nothing, which `docs/audits/80-config-and-env.md` already records
-* as a finding across the env surface; fixing it here alone would make this one
-* variable disagree with the rest.
+* Any spelling of yes, through the platform's one parser. It was an exact
+* `"true"` until that parser existed, deliberately, so that this variable would
+* not be fixed alone and left disagreeing with the rest.
 */
 function isRoleSwitchingOptedOut() {
-	return process.env.DISABLE_DB_ROLE_SWITCHING === "true";
+	return parseEnvBoolean(process.env.DISABLE_DB_ROLE_SWITCHING) === true;
 }
 /**
 * The role a statement will actually have run as, given the role it asked for.
@@ -6093,6 +6092,35 @@ function assertActingUserForAutoValues(properties, status, uid, path) {
 		});
 	}
 }
+/**
+* A listener's `onError`, in the shape the realtime service calls it with.
+*
+* Registered with the subscription so a failed refetch reaches it. Before, only
+* the initial fetch did: a refetch after a change failed into a log line, and
+* the listener kept its last rows as if they were current. The error arrives as
+* thrown, not masked the way a socket frame is: this is trusted server code.
+*/
+function fetchErrorListener(onError) {
+	if (!onError) return void 0;
+	return (error) => onError(error instanceof Error ? error : new Error(String(error)));
+}
+/**
+* The principal a user's reads run as, for the transaction a request opens and
+* for a subscription alike.
+*
+* One definition because there were two. The subscription's copy was built by
+* hand after the fact and left out `isAnonymous`, so a guest's refetches ran as
+* an account: a policy that excludes guests filtered the first read and not the
+* ones after a change.
+*/
+function authContextOf(user) {
+	return {
+		uid: user?.uid || ANONYMOUS_USER_ID,
+		roles: user?.roles ?? [],
+		isAnonymous: user?.isAnonymous === true,
+		...user?.claims ? { claims: user.claims } : {}
+	};
+}
 var PostgresBackendDriver = class PostgresBackendDriver {
 	db;
 	registry;
@@ -6411,46 +6439,31 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		}
 		return rows;
 	}
-	listenCollection({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, onUpdate, onError }) {
+	/**
+	* Listen to a collection: the rows now, then again after every change.
+	*
+	* The realtime service runs every read, the first one included, as
+	* `authContext` — which {@link AuthenticatedPostgresBackendDriver} supplies,
+	* and which defaults to this driver's own user (a driver bound to a
+	* request's transaction has one). With neither, the reads run as the
+	* anonymous user, as the refetches always did.
+	*/
+	listenCollection({ path, collection, startAfter, onUpdate, onError, vectorSearch: _vectorSearch, page: _page, withDeleted: _withDeleted, ...query }, authContext = this.user ? authContextOf(this.user) : void 0) {
 		const subscriptionId = this.generateSubscriptionId();
-		const callbackWrapper = (rows) => {
-			onUpdate(rows);
-		};
-		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
-			clientId: "driver",
+		this.realtimeService.startDataDriverSubscription(subscriptionId, {
 			type: "collection",
 			path,
 			collectionRequest: {
-				filter,
-				orderBy,
-				order,
-				limit,
-				offset,
+				...query,
 				startAfter,
-				databaseId: collection?.databaseId,
-				searchString
-			}
-		});
-		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
-		this.fetchCollection({
-			path,
-			collection,
-			filter,
-			limit,
-			offset,
-			startAfter,
-			orderBy,
-			searchString,
-			order
-		}).then((rows) => {
-			callbackWrapper(rows);
-		}).catch((error) => {
-			if (onError) onError(error);
+				databaseId: collection?.databaseId
+			},
+			authContext,
+			onError: fetchErrorListener(onError)
+		}, (rows) => {
+			if (Array.isArray(rows)) onUpdate(rows);
 		});
-		return () => {
-			this.realtimeService.removeSubscriptionCallback(subscriptionId);
-			this.realtimeService.subscriptions.delete(subscriptionId);
-		};
+		return () => this.realtimeService.unsubscribe(subscriptionId);
 	}
 	async fetchOne({ path, id, databaseId, collection, withDeleted }) {
 		let row = await this.dataService.fetchOne(path, id, databaseId || collection?.databaseId, withDeleted);
@@ -6479,31 +6492,23 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 		}
 		return row;
 	}
-	listenOne({ path, id, collection, onUpdate, onError }) {
+	/**
+	* Listen to one row: the row now, then again after every change, and
+	* `null` when it is not there — deleted, never created, or not readable by
+	* the subscriber. Reads as {@link listenCollection} does.
+	*/
+	listenOne({ path, id, onUpdate, onError }, authContext = this.user ? authContextOf(this.user) : void 0) {
 		const subscriptionId = this.generateSubscriptionId();
-		const callbackWrapper = (row) => {
-			if (row) onUpdate(row);
-		};
-		this.realtimeService.registerDataDriverSubscription(subscriptionId, {
-			clientId: "driver",
+		this.realtimeService.startDataDriverSubscription(subscriptionId, {
 			type: "single",
-			path,
-			id
-		});
-		this.realtimeService.addSubscriptionCallback(subscriptionId, callbackWrapper);
-		this.fetchOne({
 			path,
 			id,
-			collection
-		}).then((row) => {
-			if (row) onUpdate(row);
-		}).catch((error) => {
-			if (onError) onError(error);
+			authContext,
+			onError: fetchErrorListener(onError)
+		}, (row) => {
+			if (!Array.isArray(row)) onUpdate(row);
 		});
-		return () => {
-			this.realtimeService.removeSubscriptionCallback(subscriptionId);
-			this.realtimeService.subscriptions.delete(subscriptionId);
-		};
+		return () => this.realtimeService.unsubscribe(subscriptionId);
 	}
 	/**
 	* How many membership rows a single write will read to answer "which
@@ -6917,20 +6922,10 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			for (let i = 0; i < ids.length; i++) {
 				const id = ids[i];
 				try {
-					const existing = await txDriver.fetchOne({
-						path,
-						id: String(id),
-						collection
-					});
-					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
-						statusCode: 404,
-						code: "NOT_FOUND"
-					});
 					await txDriver.delete({
 						row: {
 							id: String(id),
-							path,
-							values: existing
+							path
 						},
 						collection,
 						hard
@@ -7010,27 +7005,16 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 								status: "existing"
 							});
 							break;
-						case "delete": {
-							const existing = await txDriver.fetchOne({
-								path: operation.path,
-								id,
-								collection: operation.collection
-							});
-							if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
-								statusCode: 404,
-								code: "NOT_FOUND"
-							});
+						case "delete":
 							await txDriver.delete({
 								row: {
 									id,
-									path: operation.path,
-									values: existing
+									path: operation.path
 								},
 								collection: operation.collection
 							});
 							row = null;
 							break;
-						}
 					}
 					if (operation.ref && row) named.set(operation.ref, row);
 					results.push(row);
@@ -7047,8 +7031,15 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 	}
 	async delete({ row, collection, hard }) {
 		const targetPath = row.path;
-		const targetRow = { ...row.values ?? {} };
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, targetPath);
+		const stored = await this.fetchOne({
+			path: targetPath,
+			id: row.id,
+			collection: resolvedCollection,
+			withDeleted: hard ? true : void 0
+		});
+		if (!stored) throw ApiError.notFound(`No row "${row.id}" in "${targetPath}" to delete.`);
+		const targetRow = { ...stored };
 		const contextForCallback = this.buildCallContext();
 		try {
 			if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
@@ -7121,7 +7112,7 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			tableName: targetPath,
 			id: row.id.toString(),
 			action: "delete",
-			values: row.values ?? {},
+			values: stored,
 			updatedBy: this.user?.uid
 		});
 		if (this._deferNotifications) this._pendingNotifications.push({
@@ -7417,19 +7408,9 @@ var AuthenticatedPostgresBackendDriver = class {
 		const pendingNotifications = [];
 		const writeScope = options?.accessMode === "read only" ? void 0 : new WriteTransactionScope();
 		const result = await withFieldViewer({ roles: this.user?.roles ?? [] }, async () => await runInWriteScope(writeScope, () => this.delegate.db.transaction(async (tx) => {
-			let uid = this.user?.uid;
-			if (!uid) {
-				logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
-				uid = "anonymous";
-			}
-			const userRoles = this.user?.roles ?? [];
+			if (!this.user?.uid) logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
 			if (!this.user?.roles) logger.warn("[DataDriver] User roles are missing for authenticated delegate. Using empty array. User object", { detail: this.user });
-			await applyAuthContext(tx, {
-				uid,
-				roles: userRoles,
-				isAnonymous: this.user?.isAnonymous === true,
-				claims: this.user?.claims
-			}, this.delegate.rlsUserRole);
+			await applyAuthContext(tx, authContextOf(this.user), this.delegate.rlsUserRole);
 			const txEntityService = new DataService(tx, this.delegate.registry);
 			const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
 			txDelegate.dataService = txEntityService;
@@ -7459,28 +7440,21 @@ var AuthenticatedPostgresBackendDriver = class {
 		return this.withTransaction((delegate) => delegate.fetchCollection(props), { accessMode: "read only" });
 	}
 	/**
-	* Injects the authenticated user's context into the most recently
-	* registered realtime subscription so RLS-aware polling can apply.
+	* The delegate is the base driver, on the owner connection. The user's
+	* identity goes in with the subscription, so the first read runs as them
+	* like every refetch after it. It used to be stamped onto the last
+	* registered subscription once the delegate had returned — by which time
+	* the first read had been issued unscoped, and a listener was handed rows
+	* its policies deny.
 	*/
-	injectAuthContext(unsubscribe) {
-		const authContext = {
-			uid: this.user?.uid || "anonymous",
-			roles: this.user?.roles ?? [],
-			...this.user?.claims ? { claims: this.user.claims } : {}
-		};
-		const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());
-		const lastSub = entries[entries.length - 1]?.[1];
-		if (lastSub && lastSub.clientId === "driver") lastSub.authContext = authContext;
-		return unsubscribe;
-	}
 	listenCollection(props) {
-		return this.injectAuthContext(this.delegate.listenCollection(props));
+		return this.delegate.listenCollection(props, authContextOf(this.user));
 	}
 	async fetchOne(props) {
 		return this.withTransaction((delegate) => delegate.fetchOne(props), { accessMode: "read only" });
 	}
 	listenOne(props) {
-		return this.injectAuthContext(this.delegate.listenOne(props));
+		return this.delegate.listenOne(props, authContextOf(this.user));
 	}
 	async save(props) {
 		return this.withTransaction((delegate) => delegate.save(props));
@@ -9115,36 +9089,67 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	*
 	* The last two are identity, not presence: the map has to still hold *this
 	* exact object*, not merely something under this id.
+	*
+	* A failure goes through the same slot, by `mayReportFailure()`: an error
+	* frame from a stale, cancelled or replaced fetch would mark a view that
+	* already shows newer rows as failed, or fail another subscription's view.
+	* It also answers yes to the delivery that already claimed the slot, since
+	* that is the send itself failing (a row that will not serialise) after the
+	* check passed and before anything reached the subscriber.
 	*/
 	beginDelivery(subscriptionId, subscription) {
 		const seq = ++subscription.started;
-		return () => {
+		const canDeliver = () => {
 			if (this._subscriptions.get(subscriptionId) !== subscription) return false;
 			if (seq <= subscription.delivered) return false;
 			subscription.delivered = seq;
 			return true;
 		};
+		const mayReportFailure = () => canDeliver() || this._subscriptions.get(subscriptionId) === subscription && subscription.delivered === seq;
+		return Object.assign(canDeliver, { mayReportFailure });
 	}
-	registerDataDriverSubscription(subscriptionId, subscription) {
-		this.debugLog("📋 [RealtimeService] Registering DataDriver subscription:", subscriptionId, subscription.authContext ? "(with auth)" : "(no auth)");
-		this._subscriptions.set(subscriptionId, {
-			...subscription,
+	/**
+	* Start an in-process listener: register it, then deliver its first rows.
+	*
+	* The first fetch runs here, as the subscriber and through a delivery slot,
+	* the way every refetch after it does. `PostgresBackendDriver.listen*` used
+	* to run it themselves, outside this service, and got all three wrong: a
+	* listener on `withAuth(user)` read its first rows on the owner connection,
+	* so it was handed rows its policies deny; a slow first fetch landed over a
+	* newer refetch, and after an unsubscribe; and a row listener never heard a
+	* `null`. The subscriber's identity is part of the request because a
+	* subscription registered first and stamped with it afterwards has a first
+	* fetch that ran before the stamp.
+	*
+	* No `authContext` reads as the anonymous user, first fetch and refetches
+	* alike — see {@link fetchCollectionWithAuth}.
+	*/
+	startDataDriverSubscription(subscriptionId, request, callback) {
+		this.debugLog("📋 [RealtimeService] Starting DataDriver subscription:", subscriptionId, request.authContext ? "(with auth)" : "(no auth)");
+		const subscription = {
+			clientId: "driver",
+			...request,
 			started: 0,
 			delivered: 0
-		});
-	}
-	addSubscriptionCallback(subscriptionId, callback) {
-		this.debugLog("📋 [RealtimeService] Adding callback for subscription:", subscriptionId);
+		};
+		this._subscriptions.set(subscriptionId, subscription);
 		this.subscriptionCallbacks.set(subscriptionId, callback);
+		this.deliverFirstToDataDriver(subscriptionId, subscription, callback);
 	}
-	removeSubscriptionCallback(subscriptionId) {
-		this.debugLog("📋 [RealtimeService] Removing callback for subscription:", subscriptionId);
-		this.subscriptionCallbacks.delete(subscriptionId);
+	async deliverFirstToDataDriver(subscriptionId, subscription, callback) {
+		const canDeliver = this.beginDelivery(subscriptionId, subscription);
+		try {
+			const data = subscription.type === "collection" ? await this.fetchCollectionWithAuth(subscription.path, subscription.collectionRequest ?? {}, subscription.authContext) : await this.fetchEntityWithAuth(subscription.path, String(subscription.id), subscription.authContext) ?? null;
+			if (canDeliver()) callback(data);
+		} catch (error) {
+			logger.error(`❌ [RealtimeService] Error in the first fetch for DataDriver subscription ${subscriptionId}`, { error });
+			this.reportDriverFetchFailure(subscriptionId, subscription, canDeliver, error);
+		}
 	}
 	/**
 	* Subscribe to collection changes (RealtimeProvider interface)
 	*/
-	subscribeToCollection(subscriptionId, config, callback) {
+	subscribeToCollection(subscriptionId, config, callback, onError) {
 		this._subscriptions.set(subscriptionId, {
 			clientId: config.clientId,
 			type: "collection",
@@ -9159,6 +9164,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				searchString: config.searchString,
 				searchExplain: config.searchExplain
 			},
+			onError,
 			started: 0,
 			delivered: 0
 		});
@@ -9167,12 +9173,13 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	/**
 	* Subscribe to single row changes (RealtimeProvider interface)
 	*/
-	subscribeToOne(subscriptionId, config, callback) {
+	subscribeToOne(subscriptionId, config, callback, onError) {
 		this._subscriptions.set(subscriptionId, {
 			clientId: config.clientId,
 			type: "single",
 			path: config.path,
 			id: config.id,
+			onError,
 			started: 0,
 			delivered: 0
 		});
@@ -9254,6 +9261,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 	}
 	async handleCollectionSubscription(clientId, request, authContext) {
 		const subscriptionId = request.subscriptionId;
+		let canDeliver;
 		try {
 			if (!this.registry.getCollectionByPath(request.path)) {
 				const registered = this.registry.getCollections().map((c) => c.slug).join(", ");
@@ -9310,17 +9318,17 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				delivered: 0
 			};
 			this._subscriptions.set(subscriptionId, subscription);
-			const canDeliver = this.beginDelivery(subscriptionId, subscription);
+			canDeliver = this.beginDelivery(subscriptionId, subscription);
 			const rows = await this.fetchCollectionWithAuth(request.path, subscription.collectionRequest, authContext);
 			const meta = await this.collectionMetaWithAuth(request.path, subscription.collectionRequest, rows, authContext);
 			if (canDeliver()) this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path, meta);
 		} catch (error) {
-			const sanitized = sanitizeErrorForClient(error, request.path);
-			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
+			this.reportSocketFetchFailure(clientId, subscriptionId, request.path, error, canDeliver);
 		}
 	}
 	async handleEntitySubscription(clientId, request, authContext) {
 		const subscriptionId = request.subscriptionId;
+		let canDeliver;
 		try {
 			if (!this.registry.getCollectionByPath(request.path)) {
 				const registered = this.registry.getCollections().map((c) => c.slug).join(", ");
@@ -9339,14 +9347,31 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				delivered: 0
 			};
 			this._subscriptions.set(subscriptionId, subscription);
-			const canDeliver = this.beginDelivery(subscriptionId, subscription);
+			canDeliver = this.beginDelivery(subscriptionId, subscription);
 			const row = await this.fetchEntityWithAuth(request.path, String(request.id), authContext);
 			if (canDeliver()) this.sendSingleUpdate(clientId, subscriptionId, row || null);
 		} catch (error) {
-			const sanitized = sanitizeErrorForClient(error, request.path);
-			this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
+			this.reportSocketFetchFailure(clientId, subscriptionId, request.path, error, canDeliver);
 		}
 	}
+	/**
+	* Answer a subscriber's failed fetch with an error frame, through the slot
+	* its rows would have used.
+	*
+	* The error is always logged (`sanitizeErrorForClient` does that), but the
+	* frame goes out only while this fetch holds the newest slot. A failed
+	* straggler used to send one regardless. The client routes errors by
+	* `subscriptionId`, so it called `onError` for a view already showing newer
+	* rows, or for the subscription that replaced this one under the same id.
+	*
+	* With no slot, the subscribe failed before its fetch began. That part runs
+	* synchronously, so nothing else can have answered the request yet.
+	*/
+	reportSocketFetchFailure(clientId, subscriptionId, path, error, canDeliver) {
+		const sanitized = sanitizeErrorForClient(error, path);
+		if (canDeliver && !canDeliver.mayReportFailure()) return;
+		this.sendError(clientId, sanitized.message, subscriptionId, sanitized.code);
+	}
 	async handleUnsubscribe(_clientId, subscriptionId) {
 		this._subscriptions.delete(subscriptionId);
 		this.subscriptionCallbacks.delete(subscriptionId);
@@ -9479,8 +9504,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				const meta = await this.collectionMetaWithAuth(notifyPath, subscription.collectionRequest, rows, subscription.authContext);
 				if (canDeliver()) this.sendCollectionUpdate(subscription.clientId, subscriptionId, rows, notifyPath, meta);
 			} catch (error) {
-				const sanitized = sanitizeErrorForClient(error, notifyPath);
-				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
+				this.reportSocketFetchFailure(subscription.clientId, subscriptionId, notifyPath, error, canDeliver);
 			}
 		}, RealtimeService.REFETCH_DEBOUNCE_MS));
 	}
@@ -9500,10 +9524,30 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				if (canDeliver()) callback(rows);
 			} catch (error) {
 				logger.error(`❌ [RealtimeService] Error in debounced driver refetch for ${subscriptionId}`, { error });
+				this.reportDriverFetchFailure(subscriptionId, subscription, canDeliver, error);
 			}
 		}, RealtimeService.REFETCH_DEBOUNCE_MS));
 	}
 	/**
+	* Tell an in-process listener its refetch failed, through the slot the
+	* rows would have used.
+	*
+	* The two driver-refetch `catch` blocks used to log and stop, so the
+	* listener heard nothing and kept its last rows as if they were current.
+	* The error goes to it as thrown: this is trusted server code, and the
+	* masking on the socket path is for clients. The slot keeps a failed
+	* straggler from reporting over newer rows, and keeps a failure away from
+	* a subscription that was cancelled or replaced while it ran.
+	*/
+	reportDriverFetchFailure(subscriptionId, subscription, canDeliver, error) {
+		if (!subscription.onError || !canDeliver()) return;
+		try {
+			subscription.onError(error);
+		} catch (listenerError) {
+			logger.error(`❌ [RealtimeService] onError threw for DataDriver subscription ${subscriptionId}`, { error: listenerError });
+		}
+	}
+	/**
 	* Fetch a collection with optional RLS auth context.
 	* When authContext is provided, the fetch runs inside a transaction
 	* with set_config calls so PostgreSQL RLS policies are enforced.
@@ -9659,8 +9703,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				const row = await this.fetchEntityWithAuth(notifyPath, id, subscription.authContext);
 				if (canDeliver()) this.sendSingleUpdate(subscription.clientId, subscriptionId, row || null);
 			} catch (error) {
-				const sanitized = sanitizeErrorForClient(error, notifyPath);
-				this.sendError(subscription.clientId, sanitized.message, subscriptionId, sanitized.code);
+				this.reportSocketFetchFailure(subscription.clientId, subscriptionId, notifyPath, error, canDeliver);
 			}
 		}, RealtimeService.REFETCH_DEBOUNCE_MS));
 	}
@@ -9680,6 +9723,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				if (canDeliver()) callback(row || null);
 			} catch (error) {
 				logger.error(`❌ [RealtimeService] Error in debounced row driver refetch for ${subscriptionId}`, { error });
+				this.reportDriverFetchFailure(subscriptionId, subscription, canDeliver, error);
 			}
 		}, RealtimeService.REFETCH_DEBOUNCE_MS));
 	}
@@ -10802,6 +10846,31 @@ function extractErrorMessage(error) {
 /**
 * Check if the current session belongs to an admin user.
 */
+/**
+* Who a socket reads and writes as, for its request frames and its
+* subscriptions alike.
+*
+* One answer because there were two, and they disagreed about guests. The
+* subscriptions carried the session's `isAnonymous`; the request frames wrote
+* `false` for every signed-in session, so a guest read and wrote as an account
+* through `FETCH_*`, `SAVE` and `DELETE` while its subscriptions did not. And a
+* socket with no session was a guest on the request frames (`true`) but not on
+* its subscriptions or over REST: an unauthenticated caller is not a guest
+* session.
+*/
+function sessionAuthContext(session) {
+	if (!session?.user) return {
+		uid: ANONYMOUS_USER_ID,
+		roles: ["anon"],
+		isAnonymous: false
+	};
+	return {
+		uid: session.user.uid,
+		roles: session.user.roles ?? [],
+		isAnonymous: session.user.isAnonymous === true,
+		...session.user.claims ? { claims: session.user.claims } : {}
+	};
+}
 function isAdminSession(session) {
 	if (!session?.user) return false;
 	if (session.user.isAdmin) return true;
@@ -10887,13 +10956,15 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 						if (adapterUser) verifiedUser = {
 							uid: adapterUser.uid,
 							roles: adapterUser.roles,
-							isAdmin: adapterUser.isAdmin
+							isAdmin: adapterUser.isAdmin,
+							isAnonymous: adapterUser.isAnonymous === true
 						};
 					} catch {}
 					else if (authConfig?.serviceKey && safeCompare(token, authConfig.serviceKey)) verifiedUser = {
 						uid: "service",
 						roles: ["admin"],
-						isAdmin: true
+						isAdmin: true,
+						isAnonymous: false
 					};
 					else {
 						const jwtPayload = await extractUserFromToken(token);
@@ -10981,25 +11052,17 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					assertFieldOpsValid(values, collection);
 				};
 				const getScopedDelegate = async () => {
-					const session = clientSessions.get(clientId);
 					if (typeof driver.withAuth === "function") try {
-						const userForAuth = session?.user ? {
-							uid: session.user.uid,
+						const who = sessionAuthContext(clientSessions.get(clientId));
+						const userForAuth = {
+							uid: who.uid,
 							displayName: null,
 							email: null,
 							photoURL: null,
 							providerId: "websocket",
-							isAnonymous: false,
-							roles: session.user.roles ?? [],
-							claims: session.user.claims
-						} : {
-							uid: ANONYMOUS_USER_ID,
-							displayName: null,
-							email: null,
-							photoURL: null,
-							providerId: "websocket",
-							isAnonymous: true,
-							roles: ["anon"]
+							isAnonymous: who.isAnonymous === true,
+							roles: who.roles,
+							...who.claims ? { claims: who.claims } : {}
 						};
 						return await driver.withAuth(userForAuth);
 					} catch (e) {
@@ -11070,7 +11133,13 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 							wsDebug("🗑️ [WebSocket Server] Processing DELETE_ENTITY request");
 							const request = payload;
 							wsDebug("🗑️ [WebSocket Server] Deleting row:", request.row);
-							await (await getScopedDelegate()).delete(request);
+							await (await getScopedDelegate()).delete({
+								row: {
+									id: request.row.id,
+									path: request.row.path
+								},
+								hard: request.hard
+							});
 							wsDebug("🗑️ [WebSocket Server] DELETE_ENTITY completed successfully");
 							const response = {
 								type: "DELETE_SUCCESS",
@@ -11296,17 +11365,7 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					case "presence_state":
 					case "channel_history": {
 						wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
-						const session = clientSessions.get(clientId);
-						const authContext = session?.user ? {
-							uid: session.user.uid,
-							roles: session.user.roles ?? [],
-							isAnonymous: session.user.isAnonymous === true,
-							claims: session.user.claims
-						} : {
-							uid: ANONYMOUS_USER_ID,
-							roles: ["anon"],
-							isAnonymous: false
-						};
+						const authContext = sessionAuthContext(clientSessions.get(clientId));
 						await realtimeService.handleClientMessage(clientId, {
 							type,
 							payload,
@@ -11342,15 +11401,18 @@ function createPostgresWebSocket(server, realtimeService, driver, authConfig, au
 					}));
 					return;
 				}
-				if (error instanceof ApiError || error?.name === "ApiError") {
-					const apiError = error;
-					logger.warn(`[WebSocket Server] Refused a write: ${apiError.message}`);
+				const answer = declaredErrorAnswer(error);
+				if (answer) {
+					const line = `[WebSocket Server] Refused: ${answer.code} ${answer.message}`;
+					if (answer.expected) logger.debug(line);
+					else logger.warn(line);
 					ws.send(JSON.stringify({
 						type: "ERROR",
 						requestId,
 						payload: { error: {
-							message: apiError.message,
-							code: apiError.code
+							message: answer.message,
+							code: answer.code,
+							...answer.details !== void 0 && { details: answer.details }
 						} }
 					}));
 					return;
@@ -11497,10 +11559,32 @@ function parseOptionalInt(value) {
 * Create a {@link CronJobDefinition} that dumps the database, uploads the
 * result to the configured destination, and prunes old backups. Object
 * destinations require {@link BackupCronConfig.storage}.
+*
+* The dump excludes nothing unless `excludeSchemas` says otherwise, and that
+* default is not this function's to set: the option goes to `createDump`
+* untouched, so `buildPgDumpArgs` decides for the cron and `rebase db backup`
+* alike. The cron used to carry its own default of `["rebase"]`, meant to
+* leave out Atlas's revision table, and it left out a lot more. `rebase` is
+* where the framework keeps
+* everything that is not a collection: the auth tables (`users`, identities,
+* refresh tokens, MFA factors, recovery codes, `app_config`, `schema_meta`),
+* API keys, record history, the job queue, cron logs, channel history,
+* branches and idempotency keys. It also holds the functions that every
+* generated RLS policy and CDC trigger calls (`rebase.uid()`,
+* `rebase.roles()`, `rebase.rebase_cdc_notify()`).
+*
+* None of that can be left for boot to rebuild. Boot recreates the tables
+* and functions, but never the rows in them. And a dump that has a policy
+* or trigger on a `public` table without the function it calls cannot be
+* restored into an empty database: `pg_restore --exit-on-error` stops at
+* the first such statement, and every collection's generated policies call
+* `rebase.uid()`. So every scheduled backup lost every user account, and
+* could not be restored anyway, while `rebase db backup` took a complete
+* one. The revision table belongs in a backup too: without it, a restored
+* database has tables but no record of the migrations that made them.
 */
 function createBackupCron(config) {
 	const dbName = parseDbNameFromUrl(config.connectionString) ?? "database";
-	const excludeSchemas = config.excludeSchemas ?? ["rebase"];
 	return {
 		name: config.name ?? "Scheduled database backup",
 		schedule: config.schedule,
@@ -11517,7 +11601,7 @@ function createBackupCron(config) {
 				connectionString: config.connectionString,
 				dbName,
 				outDir,
-				excludeSchemas
+				excludeSchemas: config.excludeSchemas
 			});
 			log(`Dump created: ${dump.fileName} (${formatBytes(dump.sizeBytes)})`);
 			const check = await validateDump(dump.localFile);
@@ -15055,7 +15139,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-Bkvehxdm.js").then((n) => n.n);
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-Cr2ye5JC.js").then((n) => n.n);
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(describeEnsureFailure(failure));
 			return { applied: plan.actions.length - plan.failures.length };
@@ -15089,7 +15173,7 @@ function createPostgresBootstrapper(pgConfig) {
 			await provisionRlsRuntime(provisioningQueryable(driverResult));
 		},
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-CQGHln-y.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-B4IDFtQ-.js");
 			const queryable = provisioningQueryable(driverResult);
 			const { rows } = await queryable.query("SELECT to_regprocedure('rebase.roles()') IS NOT NULL AS present");
 			if (!rows[0]?.present) await provisionRlsRuntime(queryable);